-= Per source details. Do not edit below this line.=-
Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information
{ "iocs": { "urls": [ "https://pastebin.com/raw/TwHdexDC", "https://canary.discord.com/api/webhooks/1153431050517762059/MAkfrB4n1Gz6qe7W8ffWTZF92yfN3D_FWPFFaK_FBgDQWB1ZYfbKHa61X_8L6GK175r0", "https://canary.discord.com/api/webhooks/1155235432406196334/3eFtMXnG2laJjInzO_kAzLbW6ebMgbrrwmAcRtZyOfqnyCh-twTT9pSumcKr5QJvbGEZ", "https://canary.discord.com/api/webhooks/1152716297474424913/z6-hvrQNeyL0m1Mm34JLYj1VVB67sVEXogqJzGCkxYgMFCgCWhQaR07ruMBck1dJAi9g", "https://canary.discord.com/api/webhooks/1152648911371120681/JlL5FnwmY6nP6RaZxmQ7NI9MGR6HARmAekaPqPDdVTq9K3RJ68Lcd7cz16l9u6eZH9c3", "https://discord.com/api/webhooks/1103033150558457876/22oUF1rkDTdxz-iq-2EOR4aVXwDr5vFIeE9zWlitIbYSG2E3XhF8KQIzuo1uXy_bOcos", "http://51.178.25.148:8081/upload", "http://51.178.25.148:8081/dl/runtime", "http://51.178.25.148:8081/uploader", "http://51.178.25.148:8081/gethw", "http://51.178.25.148:8081/dl/system", "http://51.178.25.148:8081/getip", "http://51.178.25.148:8081/dl/uwu", "http://51.178.25.148:8081/rooter", "http://51.178.25.148:8081/dl/sys86", "http://51.178.25.148:8081/dl/gamesdk" ], "ips": [ "51.178.25.148" ] }, "malicious-packages-origins": [ { "sha256": "9db59fb1fff1df375feb9a17164f004b62a2d5fa194dcc285341536b6bfb51aa", "import_time": "2023-11-22T12:35:48.824436605Z", "source": "checkmarx", "ranges": [ { "events": [ { "introduced": "0" } ], "type": "ECOSYSTEM" } ], "modified_time": "2023-10-15T10:12:58Z" }, { "sha256": "eca396a5a824b7e16bb60ccf05f1619c55d8e6c3457ac12b443bede4bc81a6e1", "import_time": "2024-06-28T02:50:06.068552057Z", "versions": [ "1.0.1" ], "id": "RLMA-2024-04488", "source": "reversing-labs", "modified_time": "2024-06-25T13:40:00Z" } ] }